What’s Vulnerable › Vulnerabilities

CVE-2026-9303: calcom cal.diy cross-site request forgery

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-23 · updated 2026-07-23
• Weakness: CWE-352

Description

A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• calcom cal.diy: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4

References

• https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48
• https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49
• https://vuldb.com/submit/812173
• https://vuldb.com/submit/812175
• https://vuldb.com/vuln/365250
• https://vuldb.com/vuln/365250/cti

Get alerted when CVE-2026-9303 or the next vulnerability affects your stack